pi-landstrip 0.1.0 → 0.2.1

package/README.md

@@ -11,7 +11,7 @@ Install `landstrip` and make sure it is on the `PATH` used to launch pi:
 cargo install landstrip
 ```
 
-`landstrip` currently targets Linux. On other platforms this extension loads
+`landstrip` supports Linux, macOS, and Windows. On other platforms this extension loads
 but leaves sandboxing disabled.
 
 ## Install

package/index.ts

@@ -72,6 +72,9 @@ interface LandstripPolicy {
   filesystem: SandboxFilesystemConfig;
 }
 
+const LANDSTRIP_VERSION = [0, 8, 3] as const;
+const SUPPORTED_PLATFORMS = new Set<NodeJS.Platform>(['linux', 'darwin', 'win32']);
+
 const DEFAULT_CONFIG: SandboxConfig = {
   enabled: true,
   network: {
@@ -97,7 +100,7 @@ const DEFAULT_CONFIG: SandboxConfig = {
   },
   filesystem: {
     denyRead: ['/Users', '/home'],
-    allowRead: ['.', '~/.config', '~/.local', '~/.cargo'],
+    allowRead: ['.', '~/.config', '~/.gitconfig', '~/.local', '~/.cargo'],
     allowWrite: ['.', '/tmp'],
     denyWrite: ['.env', '.env.*', '*.pem', '*.key'],
   },
@@ -475,6 +478,24 @@ function landstripVersion(command: string): string | null {
   return result.stdout.trim();
 }
 
+function parseVersion(version: string): [number, number, number] | null {
+  const match = version.match(/\b(\d+)\.(\d+)\.(\d+)\b/);
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+
+function hasMinimumVersion(version: string, minimum: readonly [number, number, number]): boolean {
+  const parsed = parseVersion(version);
+  if (!parsed) return false;
+
+  for (let i = 0; i < minimum.length; i++) {
+    if (parsed[i] > minimum[i]) return true;
+    if (parsed[i] < minimum[i]) return false;
+  }
+
+  return true;
+}
+
 function proxyEnv(env: NodeJS.ProcessEnv | undefined, port: number): NodeJS.ProcessEnv {
   const url = `http://127.0.0.1:${port}`;
 
@@ -928,7 +949,7 @@ export default function (pi: ExtensionAPI) {
   function enableSandbox(ctx: ExtensionContext): boolean {
     const config = loadConfig(ctx.cwd);
 
-    if (process.platform !== 'linux') {
+    if (!SUPPORTED_PLATFORMS.has(process.platform)) {
       sandboxEnabled = false;
       sandboxReady = false;
       ctx.ui.notify(`landstrip sandboxing is not supported on ${process.platform}`, 'warning');
@@ -943,6 +964,13 @@ export default function (pi: ExtensionAPI) {
       return false;
     }
 
+    if (!hasMinimumVersion(version, LANDSTRIP_VERSION)) {
+      sandboxEnabled = false;
+      sandboxReady = false;
+      ctx.ui.notify(`landstrip 0.8.3 or newer is required; found: ${version}`, 'error');
+      return false;
+    }
+
     sandboxEnabled = true;
     sandboxReady = true;
     warnIfAllDomainsAllowed(ctx, config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-landstrip",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Landlock-based sandboxing for pi with interactive permission prompts",
   "keywords": [
     "landstrip",

package/sandbox.json

@@ -7,9 +7,15 @@
     "allowedDomains": [
       "github.com",
       "*.github.com",
+      "api.github.com",
       "raw.githubusercontent.com",
+      "objects.githubusercontent.com",
+      "codeload.github.com",
       "registry.npmjs.org",
+      "npmjs.org",
       "*.npmjs.org",
+      "nodejs.org",
+      "*.nodejs.org",
       "crates.io",
       "*.crates.io",
       "static.crates.io"
@@ -18,8 +24,33 @@
   },
   "filesystem": {
     "denyRead": ["/home"],
-    "allowRead": [".", "~/.config", "~/.local", "~/.cargo"],
-    "allowWrite": [".", "/tmp", "~/.cargo", "~/.rustup"],
+    "allowRead": [
+      ".",
+      "/tmp",
+      "/var/tmp",
+      "/dev/null",
+      "~/.config",
+      "~/.gitconfig",
+      "~/.local",
+      "~/.cargo",
+      "~/.rustup",
+      "~/.npm",
+      "~/.cache",
+      "~/.bun",
+      "~/.node-gyp"
+    ],
+    "allowWrite": [
+      ".",
+      "/tmp",
+      "/var/tmp",
+      "/dev/null",
+      "~/.cargo",
+      "~/.rustup",
+      "~/.npm",
+      "~/.cache",
+      "~/.bun",
+      "~/.node-gyp"
+    ],
     "denyWrite": [".env", ".env.*", "*.pem", "*.key"]
   }
 }